C++判断exe是32位还是64位

bool    isPE64(TCHAR *filename)
{

    DWORD access_mode = (GENERIC_READ | GENERIC_WRITE);
    //共享模式
    DWORD share_mode = FILE_SHARE_READ | FILE_SHARE_WRITE;
    HANDLE hFile =
        CreateFile(filename,
        access_mode,
        share_mode,
        NULL,
        OPEN_ALWAYS,
        FILE_FLAG_SEQUENTIAL_SCAN,
        NULL);

    if (hFile == INVALID_HANDLE_VALUE) {
        return false;
    }
    DWORD high_size;
    DWORD file_size = GetFileSize(hFile, &high_size);

    DWORD mmf_size = 512 * 1024;
    DWORD size_high = 0;
    //创建文件映射,如果要创建内存页面文件的映射,第一个参数设置为INVALID_HANDLE_VALUE
    HANDLE  hFm = CreateFileMapping(hFile,
        NULL,
        PAGE_READWRITE,
        size_high,
        mmf_size,
        NULL);

    if (hFm == NULL){
        CloseHandle(hFile);
        return false;
    }

    size_t view_size = 1024 * 256;
    DWORD view_access = FILE_MAP_ALL_ACCESS;

    //获得映射视图
    char* base_address = (char*)MapViewOfFile(hFm, view_access, 0, 0, view_size);
    if (base_address != NULL){
        bool flag;
        IMAGE_DOS_HEADER *pDos = (IMAGE_DOS_HEADER*)base_address;
        IMAGE_NT_HEADERS *pNt = (IMAGE_NT_HEADERS*)(pDos->e_lfanew + (char*)pDos);

        if (pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 || pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64)
            flag = true;
        else
            flag = false;
        //卸载映射
        UnmapViewOfFile(base_address);
        //关闭内存映射文件
        CloseHandle(hFm);
        //关闭文件
        CloseHandle(hFile);
        return flag;
    }
    else{
        return false;
    }
}

IMAGE_FILE_HEADER 中的Machine定义了PE文件的运行环境,因此判断该变量就可以获取其可运行的环境

猜你喜欢

转载自blog.csdn.net/cosmopolitanme/article/details/80708184
今日推荐